upstream: Prague code merge [v1.13.15, v1.14.11]

.github/CODEOWNERS

@@ -3,19 +3,22 @@
 accounts/usbwallet              @karalabe
 accounts/scwallet               @gballet
 accounts/abi                    @gballet @MariusVanDerWijden
+beacon/engine                   @lightclient
 cmd/clef                        @holiman
+cmd/evm                         @holiman @MariusVanDerWijden @lightclient
 consensus                       @karalabe
 core/                           @karalabe @holiman @rjl493456442
 eth/                            @karalabe @holiman @rjl493456442
-eth/catalyst/                   @gballet
+eth/catalyst/                   @gballet @lightclient
 eth/tracers/                    @s1na
+core/tracing/                   @s1na
 graphql/                        @s1na
+internal/ethapi                 @lightclient
+internal/era                    @lightclient
 les/                            @zsfelfoldi @rjl493456442
 light/                          @zsfelfoldi @rjl493456442
 node/                           @fjl
 p2p/                            @fjl @zsfelfoldi
+params/                         @fjl @holiman @karalabe @gballet @rjl493456442 @zsfelfoldi
 rpc/                            @fjl @holiman
-p2p/simulations                 @fjl
-p2p/protocols                   @fjl
-p2p/testing                     @fjl
 signer/                         @holiman

.github/workflows/build-test.yml

@@ -15,7 +15,7 @@ jobs:
   unit-test:
     strategy:
       matrix:
-        go-version: [1.21.x]
+        go-version: [1.23.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/evm-tests.yml

@@ -15,7 +15,7 @@ jobs:
   evm-test:
     strategy:
       matrix:
-        go-version: [1.21.x]
+        go-version: [1.23.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/nancy.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     strategy:
         matrix:
-          go-version: [1.21.x]
+          go-version: [1.23.x]
           os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/pre-release.yml

@@ -15,7 +15,7 @@ jobs:
     name: Build Release
     strategy:
       matrix:
-        go-version: [1.21.x]
+        go-version: [1.23.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     name: Build Release
     strategy:
       matrix:
-        go-version: [1.21.x]
+        go-version: [1.23.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/unit-test.yml

@@ -15,7 +15,7 @@ jobs:
   unit-test:
     strategy:
       matrix:
-        go-version: [1.21.x]
+        go-version: [1.23.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:

.gitignore

@@ -28,6 +28,14 @@ build/_vendor/pkg
 /build/bin/
 /geth*.zip
 
+# used by the build/ci.go archive + upload tool
+/geth*.tar.gz
+/geth*.tar.gz.sig
+/geth*.tar.gz.asc
+/geth*.zip.sig
+/geth*.zip.asc
+
+
 # travis
 profile.tmp
 profile.cov

.golangci.yml

@@ -6,8 +6,6 @@ run:
   # default is true. Enables skipping of directories:
   #   vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
   skip-dirs-use-default: true
-  skip-files:
-    - core/genesis_alloc.go
 
 output:
   format: colored-line-number
@@ -28,7 +26,10 @@ linters:
     - durationcheck
     - exportloopref
     - whitespace
+    - revive # only certain checks enabled
 
+    ### linters we tried and will not be using:
+    ###
     # - structcheck # lots of false positives
     # - errcheck #lot of false positives
     # - contextcheck
@@ -41,23 +42,37 @@ linters:
 linters-settings:
   gofmt:
     simplify: true
+  revive:
+    enable-all-rules: false
+    # here we enable specific useful rules
+    # see https://golangci-lint.run/usage/linters/#revive for supported rules
+    rules:
+      - name: receiver-naming
+        severity: warning
+        disabled: false
+        exclude: [""]
 
 issues:
+  exclude-files:
+    - core/genesis_alloc.go
   exclude-rules:
     - path: core/state/metrics.go
       linters:
         - unused
     - path: core/txpool/legacypool/list.go
       linters:
         - staticcheck
+    - path: crypto/bn256/
+      linters:
+        - revive
+    - path: cmd/utils/flags.go
+      text: "SA1019: cfg.TxLookupLimit is deprecated: use 'TransactionHistory' instead."
+    - path: cmd/utils/flags.go
+      text: "SA1019: ethconfig.Defaults.TxLookupLimit is deprecated: use 'TransactionHistory' instead."
     - path: internal/build/pgp.go
       text: 'SA1019: "golang.org/x/crypto/openpgp" is deprecated: this package is unmaintained except for security fixes.'
     - path: core/vm/contracts.go
       text: 'SA1019: "golang.org/x/crypto/ripemd160" is deprecated: RIPEMD-160 is a legacy hash and should not be used for new applications.'
-    - path: accounts/usbwallet/trezor.go
-      text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
-    - path: accounts/usbwallet/trezor/
-      text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
   exclude:
     - 'SA1019: event.TypeMux is deprecated: use Feed'
     - 'SA1019: strings.Title is deprecated'

.mailmap

@@ -56,7 +56,6 @@ Diederik Loerakker <proto@protolambda.com>
 Dimitry Khokhlov <winsvega@mail.ru>
 
 Domino Valdano <dominoplural@gmail.com>
-Domino Valdano <dominoplural@gmail.com> <jeff@okcupid.com>
 
 Edgar Aroutiounian <edgar.factorial@gmail.com>
 

.nancy-ignore

@@ -1,3 +1,4 @@
 CVE-2024-34478 # "CWE-754: Improper Check for Unusual or Exceptional Conditions." This vulnerability is BTC only, BSC does not have the issue.
 CVE-2024-6104 # "CWE-532: Information Exposure Through Log Files" This is caused by the vulnerabilities go-retryablehttp@v0.7.4, it is only used in cmd devp2p, impact is limited. will upgrade to v0.7.7 later
-CVE-2024-8421 # "CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion)" This vulnerability is caused by issues in the golang.org/x/net package. Even the latest version(v0.29.0) has not yet addressed it, but we will continue to monitor updates closely.
+CVE-2024-8421 # "CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion)" This vulnerability is caused by issues in the golang.org/x/net package. Even the latest version(v0.29.0) has not yet addressed it, but we will continue to monitor updates closely.
+CVE-2024-51744 # "CWE-347: Improper Verification of Cryptographic Signature" & "CWE-755: Improper Handling of Exceptional Conditions" This vulnerability is caused mishandling of JWT error code, BSC does not have the issue as it does not check the detail error code.

.travis.yml

@@ -9,14 +9,13 @@ jobs:
         - azure-osx
 
   include:
-    # These builders create the Docker sub-images for multi-arch push and each
-    # will attempt to push the multi-arch image if they are the last builder
+    # This builder create and push the Docker images for all architectures
     - stage: build
       if: type = push
       os: linux
       arch: amd64
-      dist: bionic
-      go: 1.21.x
+      dist: focal
+      go: 1.23.x
       env:
         - docker
       services:
@@ -26,44 +25,27 @@ jobs:
       before_install:
         - export DOCKER_CLI_EXPERIMENTAL=enabled
       script:
-        - go run build/ci.go docker -image -manifest amd64,arm64 -upload ethereum/client-go
-
-    - stage: build
-      if: type = push
-      os: linux
-      arch: arm64
-      dist: bionic
-      go: 1.21.x
-      env:
-        - docker
-      services:
-        - docker
-      git:
-        submodules: false # avoid cloning ethereum/tests
-      before_install:
-        - export DOCKER_CLI_EXPERIMENTAL=enabled
-      script:
-        - go run build/ci.go docker -image -manifest amd64,arm64 -upload ethereum/client-go
+        - go run build/ci.go dockerx -platform "linux/amd64,linux/arm64" -upload ethereum/client-go
 
     # This builder does the Linux Azure uploads
     - stage: build
       if: type = push
       os: linux
-      dist: bionic
+      dist: focal
       sudo: required
-      go: 1.21.x
+      go: 1.23.x
       env:
         - azure-linux
       git:
         submodules: false # avoid cloning ethereum/tests
-      addons:
-        apt:
-          packages:
-            - gcc-multilib
       script:
-        # Build for the primary platforms that Trusty can manage
+        # build amd64
         - go run build/ci.go install -dlgo
         - go run build/ci.go archive -type tar -signer LINUX_SIGNING_KEY -signify SIGNIFY_KEY -upload gethstore/builds
+
+        # build 386
+        - sudo -E apt-get -yq --no-install-suggests --no-install-recommends install gcc-multilib
+        - git status --porcelain
         - go run build/ci.go install -dlgo -arch 386
         - go run build/ci.go archive -arch 386 -type tar -signer LINUX_SIGNING_KEY -signify SIGNIFY_KEY -upload gethstore/builds
 
@@ -85,61 +67,48 @@ jobs:
       if: type = push
       os: osx
       osx_image: xcode14.2
-      go: 1.21.x
+      go: 1.23.1 # See https://github.com/ethereum/go-ethereum/pull/30478
       env:
         - azure-osx
       git:
         submodules: false # avoid cloning ethereum/tests
       script:
+        - ln -sf /Users/travis/gopath/bin/go1.23.1 /usr/local/bin/go # Work around travis go-setup bug
         - go run build/ci.go install -dlgo
         - go run build/ci.go archive -type tar -signer OSX_SIGNING_KEY -signify SIGNIFY_KEY -upload gethstore/builds
         - go run build/ci.go install -dlgo -arch arm64
         - go run build/ci.go archive -arch arm64 -type tar -signer OSX_SIGNING_KEY -signify SIGNIFY_KEY -upload gethstore/builds
 
     # These builders run the tests
     - stage: build
+      if: type = push
       os: linux
       arch: amd64
-      dist: bionic
-      go: 1.21.x
+      dist: focal
+      go: 1.23.x
       script:
-        - travis_wait 30 go run build/ci.go test $TEST_PACKAGES
-
-    - stage: build
-      if: type = pull_request
-      os: linux
-      arch: arm64
-      dist: bionic
-      go: 1.20.x
-      script:
-        - travis_wait 30 go run build/ci.go test $TEST_PACKAGES
+        - travis_wait 45 go run build/ci.go test $TEST_PACKAGES
 
     - stage: build
+      if: type = push
       os: linux
-      dist: bionic
-      go: 1.20.x
+      dist: focal
+      go: 1.22.x
       script:
-        - travis_wait 30 go run build/ci.go test $TEST_PACKAGES
+        - travis_wait 45 go run build/ci.go test $TEST_PACKAGES
 
     # This builder does the Ubuntu PPA nightly uploads
     - stage: build
       if: type = cron || (type = push && tag ~= /^v[0-9]/)
       os: linux
-      dist: bionic
-      go: 1.21.x
+      dist: focal
+      go: 1.23.x
       env:
         - ubuntu-ppa
       git:
         submodules: false # avoid cloning ethereum/tests
-      addons:
-        apt:
-          packages:
-            - devscripts
-            - debhelper
-            - dput
-            - fakeroot
-            - python-bzrlib
-            - python-paramiko
+      before_install:
+        - sudo -E apt-get -yq --no-install-suggests --no-install-recommends install devscripts debhelper dput fakeroot
       script:
         - echo '|1|7SiYPr9xl3uctzovOTj4gMwAC1M=|t6ReES75Bo/PxlOPJ6/GsGbTrM0= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0aKz5UTUndYgIGG7dQBV+HaeuEZJ2xPHo2DS2iSKvUL4xNMSAY4UguNW+pX56nAQmZKIZZ8MaEvSj6zMEDiq6HFfn5JcTlM80UwlnyKe8B8p7Nk06PPQLrnmQt5fh0HmEcZx+JU9TZsfCHPnX7MNz4ELfZE6cFsclClrKim3BHUIGq//t93DllB+h4O9LHjEUsQ1Sr63irDLSutkLJD6RXchjROXkNirlcNVHH/jwLWR5RcYilNX7S5bIkK8NlWPjsn/8Ua5O7I9/YoE97PpO6i73DTGLh5H9JN/SITwCKBkgSDWUt61uPK3Y11Gty7o2lWsBjhBUm2Y38CBsoGmBw==' >> ~/.ssh/known_hosts
         - go run build/ci.go debsrc -upload ethereum/ethereum -sftp-user geth-ci -signer "Go Ethereum Linux Builder <geth-ci@ethereum.org>"
@@ -148,8 +117,8 @@ jobs:
     - stage: build
       if: type = cron
       os: linux
-      dist: bionic
-      go: 1.21.x
+      dist: focal
+      go: 1.23.x
       env:
         - azure-purge
       git:
@@ -161,8 +130,9 @@ jobs:
     - stage: build
       if: type = cron
       os: linux
-      dist: bionic
-      go: 1.21.x
+      dist: focal
+      go: 1.23.x
+      env:
+        - racetests
       script:
-        - travis_wait 30 go run build/ci.go test  -race $TEST_PACKAGES
-
+        - travis_wait 60 go run build/ci.go test -race $TEST_PACKAGES

Dockerfile

@@ -4,7 +4,7 @@ ARG VERSION=""
 ARG BUILDNUM=""
 
 # Build Geth in a stock Go builder container
-FROM golang:1.21-alpine as builder
+FROM golang:1.23-alpine AS builder
 
 RUN apk add --no-cache make cmake gcc musl-dev linux-headers git bash build-base libc-dev
 # Get dependencies - will also be cached if we won't change go.mod/go.sum

Dockerfile.alltools

@@ -4,7 +4,7 @@ ARG VERSION=""
 ARG BUILDNUM=""
 
 # Build Geth in a stock Go builder container
-FROM golang:1.21-alpine as builder
+FROM golang:1.23-alpine AS builder
 
 RUN apk add --no-cache gcc musl-dev linux-headers git
 # Get dependencies - will also be cached if we won't change go.mod/go.sum
@@ -16,6 +16,13 @@ ADD . /go-ethereum
 # For blst
 ENV CGO_CFLAGS="-O -D__BLST_PORTABLE__" 
 ENV CGO_CFLAGS_ALLOW="-O -D__BLST_PORTABLE__"
+
+# This is not strictly necessary, but it matches the "Dockerfile" steps, thus
+# makes it so that under certain circumstances, the docker layer can be cached,
+# and the builder can jump to the next (build all) command, with the go cache fully loaded.
+#
+RUN cd /go-ethereum && go run build/ci.go install -static ./cmd/geth
+
 RUN cd /go-ethereum && go run build/ci.go install -static
 
 # Pull all binaries into a second stage deploy alpine container